Changelog

This file is automatically generated from the GitHub releases page. Do not edit manually.

[23.1.0] - 2026-08-23

Added new option: `--interactiveSelect`

Usage:

ncu -i --interactiveSelect [value]

Default: auto

Control which upgrades are pre-selected in interactive mode. Only applies with --interactive.

auto	Pre-selects patch and minor upgrades with `--format group`, which is enabled by default, and all upgrades otherwise. This is what `ncu -i` does. (default)
none	Nothing is pre-selected.
patch	Patch upgrades are pre-selected.
minor	Patch and minor upgrades are pre-selected.
all	All upgrades are pre-selected, including major.

Specify auto explicitly to restore the default when another value is set in your config file.

Major version zero upgrades (e.g. 0.1.0 → 0.2.0) are only pre-selected by all, since anything may change before 1.0.0. Custom groups returned by --groupFunction are likewise only pre-selected by all.

Other Changes

LICENSE: use clean GPL-2.0 by @XhmikosR in #1979
Strip terminal escape sequences from package and registry text by @XhmikosR in #1994
Select the pnpm global config by the installed major version by @XhmikosR in #1995
Do not let rejectOnError:false swallow spawn errors by @XhmikosR in #1997
Warn when peer dependency lookups fail instead of silently disabling --peer by @XhmikosR in #1984
Test getModuleMismatchError directly instead of through a real config load by @XhmikosR in #1998
Further e2e.sh improvements by @XhmikosR in #1993
Update dependencies by @XhmikosR in #1992
Wrap option default values in code tags by @XhmikosR in #2001
Always run the deep test CLI from build by @XhmikosR in #2000
Reject invalid values in array options by @XhmikosR in #2002
doctor: pass color through to the package manager spawn by @XhmikosR in #2003
Fix operator precedence in the invalid filter message by @XhmikosR in #2004
Replace the github url version tag only in the fragment by @XhmikosR in #2005
Clean up misleading names and dead code in npm, logging and filterAndReject by @XhmikosR in #2006
Fix pnpm global and prefix args being spread into single characters by @XhmikosR in #2007
Apply boolean false from the rc config as --no- by @XhmikosR in #2008
Restrict yaml catalog upgrades to catalog paths by @XhmikosR in #2009
Only log the merged yarn config when it is not empty by @XhmikosR in #2010
Fix --no-color being ignored by @XhmikosR in #2013
Run getOwnerPerDependency at --concurrency by @XhmikosR in #2017
Fix crash when a dist-tag points to a version missing from the packument by @XhmikosR in #2011
Fix two rc-config tests that asserted nothing by @XhmikosR in #2020
Restore CHANGELOG.md and automate release-driven changelog sync by @raineorshine with @Copilot in #2014
Add min-release-age=7 to .npmrc by @XhmikosR in #2025
Remove the temp working directory created by the build-changelog tests by @XhmikosR in #2024
Update dependencies by @XhmikosR in #2023
feat(pnpm): read registries from pnpm-workspace.yaml by @smarlhens in #1973
feat: add --interactiveSelect to control pre-selected upgrades by @raineorshine in #2029

New Contributors

@smarlhens made their first contribution in #1973

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v23.0.2...v23.1.0

[23.0.2] - 2026-08-07

What's Changed

Handle unexpected pnpm ls -g output by @XhmikosR in #1958
Lazily construct the RelativeTimeFormat to avoid eager ICU init on startup by @XhmikosR in #1960
Fix Wildcard case by @XhmikosR in #1963
Update dependencies by @XhmikosR in #1967
Further e2e.sh improvements by @XhmikosR in #1961
Report npm's stderr and the real command when npm ls outputs no JSON by @XhmikosR in #1959
doctor: respect --no-color and NO_COLOR when spawning the package manager by @XhmikosR in #1970
Bound the yarn info line regex and skip non-matching lines by @XhmikosR in #1971
Fix npm casing in comments and rename hasWildCard by @XhmikosR in #1972
build(deps-dev): bump chalk from 5.6.2 to 6.0.0 by @dependabot[bot] in #1975
Shorten long build metadata in the upgrades table by @XhmikosR in #1957
Spawn tweaks by @XhmikosR in #1976
CI cleanup and tweaks by @XhmikosR in #1962
Resolve npm dist-tags by @XhmikosR in #1956
Deprecate CHANGELOG.md by @XhmikosR in #1980
Keep the resolved version when the peer recursion requeries by @XhmikosR in #1983
Fix unreachable error classification in queryVersions by @XhmikosR in #1986
Increase coverage by @XhmikosR in #1985
Handle the peerDependencies array that npm 12 outputs by @XhmikosR in #1991
e2e.sh: drop the npm view retry by @XhmikosR in #1977
Select pnpm global minimumReleaseAge config by installed major version by @raineorshine with @Copilot in #1969

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v23.0.1...v23.0.2

[23.0.1] - 2026-08-02

What's Changed

Pin Docker base image by digest by @XhmikosR in #1947
build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1950
Add zizmor workflow by @XhmikosR in #1946
Update LICENSE by @XhmikosR in #1952
Delete the unused .github/screenshot.png by @XhmikosR in #1953
Replace timeago.js with the native Intl.RelativeTimeFormat by @XhmikosR in #1936
Doc fixes by @XhmikosR in #1955
Update dependencies by @XhmikosR in #1954
build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1965
Replace libnpmconfig and figgy-pudding with an in-house npm config loader by @XhmikosR in #1934

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v23.0.0...v23.0.1

[23.0.0] - 2026-07-26

⚠️ Breaking changes & migration

1. Node.js 22+ required (#1844) The minimum supported Node.js is now 22. Supported versions: ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10).

Migration: Upgrade Node before installing. On older Node, stay on v22.x.

2. Pure ESM package — CJS build dropped, default export is now callable (#1916, #1894) The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. ncu.run() and ncu.defineConfig() still work as namespaced properties.

Migration (ESM):

// before
import * as ncu from 'npm-check-updates'
const upgraded = await ncu.run({/* ... */})
// after
import ncu from 'npm-check-updates'
const upgraded = await ncu({/* ... */}) // ncu.run({...}) also still works

Migration (CommonJS): Still usable via Node's native require() of ESM (Node 22+), but the import shape changed:

// before
const ncu = require('npm-check-updates')
// after
const { default: ncu } = require('npm-check-updates')
ncu({/* ... */}).then(upgraded => console.log(upgraded))

3. filterVersion / rejectVersion no longer accept a predicate function. Use filter / reject instead. (#1933) These options now accept only a string, wildcard, glob, comma/space-delimited list, or /regex/. (CLI usage is unchanged — the CLI never supported functions.)

Migration: If you passed a function to filterVersion/rejectVersion in .ncurc.js or via the module API, move it to filter / reject instead. Those receive the package name and the parsed current version, so they can match on both:
```
// before
filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
// after
filter: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
```

4. Output is now grouped by default (#1937) --format now defaults to ["group"], so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.

Migration: To get the old flat output, use:
```
ncu --format no-group
```
The new no- prefix removes a value from the default list instead of replacing the whole list, so --format no-group,time disables grouping while adding publish times.

5. --target semver now respects explicit upper bounds (#1920) An explicit upper bound in a range is now preserved and never exceeded, e.g. ^9.5.0 <10 → ^9.7.0 <10 (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

✨ Other improvements

Native TypeScript loading (#1888), lazy-loaded npm-registry-fetch for faster startup (#1898), and reduced dependencies for a lighter install.
Numerous bug fixes: scoped-package 404s with encoded @ (#1923), --doctor + --errorLevel 2 crash (#1900), registry settings ignored by --enginesNode/--ownerChanged (#1925), and YAML catalog preservation (#1922), abort packument stream once required fields are parsed (#1901) for better performance, fix cli options being overridden by .ncurc in --deep mode (#1902), and upgrade a package in all selected sections when versions differ.

Full changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.9...v23.0.0

[22.2.9] - 2026-06-28

What's Changed

Dockerfile: use lts-alpine image by @XhmikosR in #1862
Rename variable and test file by @XhmikosR in #1884
eslint.config.js: drop moot jest globals by @XhmikosR in #1887
replace zod with valibot to reduce bundle size by @XhmikosR in #1885
CI: add prettier in lint workflow by @XhmikosR in #1889
Use async glob instead of glob.sync in getAllPackages by @XhmikosR in #1891
Minor type tweaks by @XhmikosR in #1892
Switch mocha tests to parallel by @XhmikosR in #1886
Replace markdownlint-cli with markdownlint-cli2 by @XhmikosR in #1893

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.8...v22.2.9

[22.2.8] - 2026-06-27

What's Changed

CI: remove concurrency by @XhmikosR in #1846
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in #1872
Downgrade ts-json-schema-generator to v2.4.0 for Node.js 20 support by @XhmikosR in #1848
prepare: add exit 0 as an extra guard by @XhmikosR in #1850
ESLint: bump to es2023 globals by @XhmikosR in #1854
package.json: remove redundant tests from files by @XhmikosR in #1855
tsconfig: enable verbatimModuleSyntax by @XhmikosR in #1860
Remove the unused libnpmconfig.d.ts by @XhmikosR in #1857
Clean up run() return type JSDoc by @XhmikosR in #1868
cache test: remove any previous stale cache file to prevent failures by @XhmikosR in #1865
package.json: remove duplicate typecheck script by @XhmikosR in #1856
Doctor tests cleanup by @XhmikosR in #1869
fix: skip cache write when cooldown is active by @XhmikosR in #1871
Fix stale @param names in JSDoc by @XhmikosR in #1874
Simplify tsconfig.json by @XhmikosR in #1858
Add a .npmrc file enabling engine-strict by @XhmikosR in #1847
Enforce node: protocol and dedupe imports by @XhmikosR in #1842
Fix verbose log printing local yarn config under "user yarn config" header by @XhmikosR in #1875
lint: add --continue-on-error by @XhmikosR in #1859
test: cover $ override references by @XhmikosR in #1877
CI updates by @XhmikosR in #1870
More shell tweaks by @XhmikosR in #1853
Update interactive hint for q button by @XhmikosR in #1879
Vite config cleanup by @XhmikosR in #1861
package.json: remove unneeded overrides by @XhmikosR in #1849
build: stub unused iconv-lite out of the bundle by @XhmikosR in #1881
package.json: specify allowScripts by @XhmikosR in #1878
build(deps): bump softprops/action-gh-release by @dependabot[bot] in #1880
refactor prettifyCooldown and share the cooldown regex by @XhmikosR in #1883
build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #1876
fix(cooldown): scope auto-cooldown config to active package manager only by @raineorshine with @Copilot in #1882

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.7...v22.2.8

[22.2.7] - 2026-06-20

What's Changed

Fix CodeQL issues by @XhmikosR in #1813
Escape package name and reuse escapeRegExp by @XhmikosR in #1838
Remove redundant awaits and enable @typescript-eslint/await-thenable by @XhmikosR in #1839
Stop exporting the externally unused getOwnerPerDependency by @XhmikosR in #1840
Perf improvements by @XhmikosR in #1843
Move configs out of package.json by @XhmikosR in #1841
build(deps): downgrade ini from 7.0.0 to 6.0.0 to restore Node 20 support by @raineorshine in #1845

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.6...v22.2.7

[22.2.6] - 2026-06-20

What's Changed

build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in #1787
build(deps-dev): bump @typescript-eslint/parser from 8.60.1 to 8.61.0 by @dependabot[bot] in #1788
build(deps-dev): bump @microsoft/api-extractor from 7.58.7 to 7.58.8 by @dependabot[bot] in #1789
build(deps-dev): bump eslint-plugin-n from 18.0.1 to 18.1.0 by @dependabot[bot] in #1790
build(deps-dev): bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in #1792
build(deps-dev): bump semver from 7.8.2 to 7.8.3 by @dependabot[bot] in #1793
build(deps-dev): bump cosmiconfig from 9.0.1 to 9.0.2 by @dependabot[bot] in #1791
build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 by @dependabot[bot] in #1795
Dependabot: add github-actions updates and group updates with a cooldown by @XhmikosR in #1785
CI: harden and align GitHub Actions workflows by @XhmikosR in #1786
feat: respect min-release-age-exclude with min-release-age npm config by @Cherry in #1797
feat: add Claude Code SKILL file for npm-check-updates by @ilteoood in #1798
build(deps): bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in #1799
Quote global package specs with a period in the scope for PowerShell compatibility by @raineorshine with @Copilot in #1800
Add a GitHub workflow to clean up closed PRs' caches by @XhmikosR in #1804
package.json: fix npm scripts to be cross-platform by @XhmikosR in #1805
Replace the unmaintained npm-run-all with npm-run-all2 and remove unused deps by @XhmikosR in #1806
build workflow: add npm pack --dry-run by @XhmikosR in #1807
test/e2e.sh: fix shellcheck issues by @XhmikosR in #1808
Replace rfdc with native structuredClone by @XhmikosR in #1809
Replace js-yaml with yaml by @XhmikosR in #1810
Replace dequal with node:util isDeepStrictEqual by @XhmikosR in #1811
fix: do not call semver.minVersion on non-semver package protocols by @duniul in #1767
Convert inline code backticks to <code> in generated HTML tables by @XhmikosR in #1814
Fix skills by @XhmikosR in #1815
Vite: use 'oxc' for minify by @XhmikosR in #1816
build(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in #1817
build-options.ts: split README and schema writes, drop duplicate RunOptions.json write by @XhmikosR in #1818
Remove lodash-es by @XhmikosR in #1819
Replace cosmiconfig with lilconfig by @XhmikosR in #1812
Remove redundant Promise.resolve in fetchUpgradedPackument by @XhmikosR in #1823
Switch to async/await in a few more places by @XhmikosR in #1824
Replace forEach with for...of by @XhmikosR in #1825
Yarn test fixes by @XhmikosR in #1828
fix padLeft adding trailing spaces to blank lines by @XhmikosR in #1829
Remove unused dev dependencies by @XhmikosR in #1820
fix: replace async reduce with for-of loop in --deep to avoid OOM by @XhmikosR in #1831
test.yml: remove redundant permissions block by @XhmikosR in #1832
fix MaxListenersExceededWarning when calling run() repeatedly by @XhmikosR in #1833
fix: resolve workspace paths relative to --packageFile dir, not cwd by @XhmikosR in #1834
fix: inline semver-utils types in the d.ts rollup by @XhmikosR in #1835
Drop rimraf in favor of Vite emptyOutDir by @XhmikosR in #1821
CI: add Node.js 26 by @XhmikosR in #1836
CI tweaks by @XhmikosR in #1837
Move src/scripts to the root folder by @XhmikosR in #1827

New Contributors

@ilteoood made their first contribution in #1798
@duniul made their first contribution in #1767

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.5...v22.2.6

[22.2.5] - 2026-06-06

e951cf45 Bump minor and patch. 0f9f53d8 prettier edf42129 Make deep tests path-agnostic with regex patterns b8201313 Only show missing time when time or cooldown format is requested

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.3...v22.2.5

[22.2.4] - 2026-06-06

[ignore]

[22.2.3] - 2026-06-06

What's Changed

build(deps-dev): bump semver from 7.8.0 to 7.8.1 by @dependabot[bot] in #1760
build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in #1781
build(deps-dev): bump unplugin-dts from 1.0.1 to 1.0.2 by @dependabot[bot] in #1780
build(deps-dev): bump eslint-import-resolver-typescript by @dependabot[bot] in #1779
build(deps-dev): bump tsx from 4.22.3 to 4.22.4 by @dependabot[bot] in #1778
fix: handle registries missing 'time' metadata during version resolution by @onemen in #1763
Fall back to pnpm global config for minimumReleaseAge cooldown by @Copilot in #1777

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.2...v22.2.3

[22.2.2] - 2026-06-03

What's Changed

test: use node util to strip ansi in deep test by @terminalchai in #1769
build(deps-dev): bump vite from 8.0.13 to 8.0.16 by @dependabot[bot] in #1774
Switch from vite-plugin-dts to unplugin-dts by @Copilot in #1749
test: remove unused temp directory creation by @terminalchai in #1770
test: cover Windows spawn command fallback by @terminalchai in #1771
build(deps-dev): bump sinon from 21.1.2 to 22.0.0 by @dependabot[bot] in #1751
fix: parse Yarn duration string format for npmMinimalAgeGate by @Copilot in #1768
build(deps-dev): bump @types/bun from 1.3.13 to 1.3.14 by @dependabot[bot] in #1754
build(deps-dev): bump @typescript-eslint/parser from 8.59.4 to 8.60.1 by @dependabot[bot] in #1773
build(deps-dev): bump mocha from 11.7.5 to 11.7.6 by @dependabot[bot] in #1753
build(deps-dev): bump verdaccio from 6.6.0 to 6.7.2 by @dependabot[bot] in #1759

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.1...v22.2.2

[22.2.1] - 2026-05-24

What's Changed

build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in #1727
build(deps-dev): bump verdaccio from 6.5.2 to 6.6.0 by @dependabot[bot] in #1728
build(deps-dev): bump yaml from 2.8.4 to 2.9.0 by @dependabot[bot] in #1729
fix: normalize blank-line spacing between packages in --deep mode by @terminalchai in #1738
Fix TypeError when running ncu from a subdirectory without a package.json by @Copilot in #1737
build(deps-dev): bump semver from 7.7.4 to 7.8.0 by @dependabot[bot] in #1731
build(deps-dev): bump ini from 6.0.0 to 7.0.0 by @dependabot[bot] in #1726
build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.59.3 to 8.59.4 by @dependabot[bot] in #1739
build(deps-dev): bump vite from 8.0.9 to 8.0.13 by @dependabot[bot] in #1740
build(deps-dev): bump tsx from 4.21.0 to 4.22.3 by @dependabot[bot] in #1741
build(deps-dev): bump @typescript-eslint/parser from 8.59.3 to 8.59.4 by @dependabot[bot] in #1743
build(deps-dev): bump @types/node from 25.6.0 to 25.9.1 by @dependabot[bot] in #1744
build(deps-dev): bump vite-plugin-dts from 4.5.4 to 5.0.0 by @dependabot[bot] in #1713
build(deps-dev): bump @eslint/compat from 2.0.5 to 2.1.0 by @dependabot[bot] in #1732

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.2.0...v22.2.1

[22.2.0] - 2026-05-12

What's Changed

build(deps): bump fast-uri from 3.1.0 to 3.1.2 by @dependabot[bot] in #1724
feat: add cooldown format and improved visibility for skipped updates by @onemen in #1711

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.1.1...v22.2.0

[22.1.1] - 2026-05-07

What's Changed

npm: decorateTagPackumentWithTimeAndName accepts undefined tagPackument by @SAY-5 in #1706
fix: skip intersects() for non-semver specs like catalog: in peer dep checks by @terminalchai in #1710
Bump yaml from 2.8.3 to 2.8.4 by @dependabot[bot] in #1714
Bump @typescript-eslint/eslint-plugin from 8.59.1 to 8.59.2 by @dependabot[bot] in #1716
Bump @typescript-eslint/parser from 8.59.1 to 8.59.2 by @dependabot[bot] in #1718
build(deps-dev): bump eslint-plugin-n from 17.24.0 to 18.0.1 by @dependabot[bot] in #1715
build(deps-dev): bump zod from 4.3.6 to 4.4.3 by @dependabot[bot] in #1719
build(deps-dev): bump globals from 17.5.0 to 17.6.0 by @dependabot[bot] in #1717
build(deps-dev): bump hosted-git-info from 9.0.2 to 9.0.3 by @dependabot[bot] in #1720

New Contributors

@SAY-5 made their first contribution in #1706

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.1.0...v22.1.1

[22.1.0] - 2026-05-02

What's Changed

fix: make --dep and --format robust to PowerShell arg rewriting (comma-or-space-delimited) by @onemen in #1694
Bump @typescript-eslint/eslint-plugin from 8.59.0 to 8.59.1 by @dependabot[bot] in #1697
Bump eslint-plugin-promise from 7.2.1 to 7.3.0 by @dependabot[bot] in #1702
Bump @types/bun from 1.3.12 to 1.3.13 by @dependabot[bot] in #1699
Bump vite-bundle-analyzer from 1.3.7 to 1.3.8 by @dependabot[bot] in #1700
Enhance --format time: consistent caching, interactive support, and human-readable timestamps by @onemen in #1693
fix: ignore .pnpm-store in glob traversal to prevent OOM with --deep by @Copilot in #1705

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.0.1...v22.1.0

[22.0.1] - 2026-04-25

What's Changed

fix: suppress cooldown config log messages when JSON output is active by @Copilot in #1692

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v22.0.0...v22.0.1

[22.0.0] - 2026-04-25

Breaking Changes

--cooldown now falls back to the greatest non-prerelease version rather than skipping the upgrade entirely when the latest version falls within the cooldown window.

This only affects --cooldown (or inferred cooldown from min-release-age/minimumReleaseAge/npmMinimalAgeGate).
This only affects --target latest (which is the default).

⚠️ WARNING

In rare circumstances, it is now possible for ncu --cooldown 10 to install a version that was never published to latest. This is because the npm registry does not store a history of versions published to the latest dist-tag. It is impossible to fall back to an earlier latest version, because there is no record of it. However, we do have a list of all published versions, and it's likely that a boring version like 1.0.1 was published to latest at some point. Versions like 1.0.1-pre.0, 1.0.1-beta, 1.0.1-build.58157394, etc will be ignored, as you would expect.

While npm-check-updates typically takes a conservative approach to version upgrades, following semver exactly and only upgrading to the latest version, falling back to the highest version outside the cooldown window is clearly the more intuitive behavior, and this outweighs the few cases where the results would be undesirable. The discussion in #1556 and the large amount of confusion since the initial release of --cooldown attest to this.

How to opt out of the new behavior

You can opt out of the new behavior by using --target "@latest". This forces a strict upgrade (or downgrade) to the latest tag only, without any fallback behavior.

For granular control, use a custom ncurc function to set the target or disable cooldown for a single package.

What's Changed

Bump verdaccio from 6.5.1 to 6.5.2 by @dependabot[bot] in #1679
Bump vite from 8.0.8 to 8.0.9 by @dependabot[bot] in #1680
Bump @typescript-eslint/parser from 8.58.2 to 8.59.0 by @dependabot[bot] in #1681
Bump @typescript-eslint/eslint-plugin from 8.58.2 to 8.59.0 by @dependabot[bot] in #1682
Update dependencies by @onemen in #1685
build: stub cosmiconfig's typescript dependency to reduce bundle size by 8MB by @onemen in #1686
feat(cooldown): fall back to greatest passing version when latest is within cooldown by @marcosgilf in #1688

New Contributors

@marcosgilf made their first contribution in #1688

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v21.0.3...v22.0.0

[21.0.3] - 2026-04-21

What's Changed

fix: chmod build/cli.js executable after vite build by @raineorshine in #1678
fix: migrate from rc-config-loader to cosmiconfig for ESM config support (closes #1674) by @onemen in #1676

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v21.0.2...v21.0.3

[21.0.2] - 2026-04-16

What's Changed

fix: skip intersects() for non-semver specs like catalog: in peer dep checks by @terminalchai in #1675

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v21.0.1...v21.0.2

[21.0.1] - 2026-04-15

What's Changed

fix: seeing catalog when inside workspaces by @Zamiell in #1656
Bump @types/bun from 1.3.11 to 1.3.12 by @dependabot[bot] in #1663
Bump globals from 17.4.0 to 17.5.0 by @dependabot[bot] in #1664
Bump @typescript-eslint/parser from 8.58.1 to 8.58.2 by @dependabot[bot] in #1665
Bump prettier from 3.8.1 to 3.8.2 by @dependabot[bot] in #1667
Bump verdaccio from 6.4.0 to 6.5.0 by @dependabot[bot] in #1669
Bump sinon from 21.0.3 to 21.1.2 by @dependabot[bot] in #1668
Skip CI on PRs with no file changes by @Copilot in #1672
Bump @typescript-eslint/eslint-plugin from 8.58.1 to 8.58.2 by @dependabot[bot] in #1666
Fix wrong message when all packages are within cooldown window by @Copilot in #1671

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v21.0.0...v21.0.1

[21.0.0] - 2026-04-14

⚠️ Breaking Changes

This is a major breaking change with significant architectural updates.

ESM Migration & Module System

Pure ESM: Converted to pure ESM with dual-build support (ESM/CJS) via Vite 8.
Import Syntax: Programmatic usage now requires named imports or namespace imports.
- Old: import ncu from 'npm-check-updates'
- New: import * as ncu from 'npm-check-updates' or import { run } from 'npm-check-updates'
Node.js Requirements: Now requires ^20.19.0 || ^22.12.0 || >=24.0.0. This is required for native require(esm) support and the Rolldown engine.
npm Requirements: Minimum version increased to >=10.0.0.

Configuration Files (`.ncurc.js`)

Files named .ncurc.js that use module.exports will now fail in projects that are not "type": "module".
Fix: Rename these files to .ncurc.cjs or convert them to use export default.

Dependency Updates (Pure ESM versions)

Package	Old Version	New Version
`camelcase`	`^6.3.0`	`^9.0.0`
`chai`	`^4.3.10`	`^6.2.2`
`chai-as-promised`	`^7.1.2`	`^8.0.2`
`find-up`	`5.0.0`	`8.0.0`
`p-map`	`^4.0.0`	`^7.0.4`
`untildify`	`^4.0.0`	`^6.0.0`

Tooling & Build Changes

Vite 8 Upgrade: Migrated to Vite 8 with the new Rust-based Rolldown bundler (10-30x faster builds).
TypeScript 6.0: Adopted latest type-system features and performance improvements.
Strip ANSI: Replaced strip-ansi with Node.js built-in util.stripVTControlCharacters.
Test Runner: Replaced vite-node with tsx for TypeScript support in ESM context.

Migration Guide

If you are upgrading to v21 from earlier versions:

1. Environment Check

Ensure you meet the new Node.js requirement: ^20.19.0 || ^22.12.0 || >=24.0.0.
Update npm to at least 10.0.0.

2. Update Configuration Files

If you have a .ncurc.js file:

Option A: Rename it to .ncurc.cjs.

Option B: Convert it to ESM:

import { defineConfig } from 'npm-check-updates'

export default defineConfig({
  upgrade: true,
  filter: name => name.startsWith('@myorg/'),
})

3. Update Programmatic Usage

If you import npm-check-updates in your scripts:

ESM: Change import ncu from ... to import * as ncu from 'npm-check-updates'.
CommonJS: Ensure you are destructuring the named exports or using the full object:

const ncu = require('npm-check-updates')
// Use ncu.run(...)

Testing

Tests now use tsx for module loading. When running tests manually:

mocha --node-option import=tsx 'test/**/*.test.ts'

Or use the npm script:

npm test

Related Issues & PRs

PR 1649

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v20.0.2...v21.0.0

[20.0.2] - 2026-04-13

What's Changed

Show auto-detected cooldown source at normal log level; fix test isolation by @bayraak in #1662

New Contributors

@bayraak made their first contribution in #1662

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v20.0.1...v20.0.2

[20.0.1] - 2026-04-10

What's Changed

Add CI workflow to verify build output is committed by @Copilot in #1645
Bump lodash-es from 4.17.23 to 4.18.1 by @dependabot[bot] in #1647
Add Node v24 to test workflow by @Copilot in #1608
feat: remove pre-push git hook by @Zamiell in #1658
feat: add verbose output when packages are skipped due to cooldown by @Copilot in #1659

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v20.0.0...v20.0.1

[20.0.0] - 2026-03-31

Auto Cooldown

The cooldown option is now automatically applied from the respective package manager's config:

npm - min-release-age (#1632)
yarn - npmMinimalAgeGate (excluding npmPreapprovedPackages) (#1643)
pnpm - minimumReleaseAge (excluding minimumReleaseAgeExclude) (#1639)

Why is this a breaking change?

If you use any of the above configs, npm-check-updates will automatically exclude releases that do not exceed the specified minimum age as described in https://github.com/raineorshine/npm-check-updates#cooldown.
Otherwise, you don't need to do anything.

Other changes

Bump strip-ansi from 7.1.2 to 7.2.0 by @dependabot[bot] in #1620
Bump lodash and @types/lodash by @dependabot[bot] in #1615
Bump @typescript-eslint/eslint-plugin from 8.44.1 to 8.57.2 by @dependabot[bot] in #1619
Bump hosted-git-info from 9.0.0 to 9.0.2 by @dependabot[bot] in #1622
Bump glob and markdownlint-cli by @dependabot[bot] in #1625
update dependencies; fix vulnerabilities by @onemen in #1630
Potential fix for code scanning alert no. 13: Incomplete string escaping or encoding by @raineorshine in #1640

New Contributors

@onemen made their first contribution in #1630
@Copilot made their first contribution in #1632

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.6.6...v20.0.0

[19.6.6] - 2026-03-26

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.6.5...v19.6.6

[19.6.5] - 2026-03-16

What's Changed

fix(pnpm): fallback from pnpm.cmd to pnpm on Windows for non-standard installs by @terminalchai in #1606

New Contributors

@terminalchai made their first contribution in #1606

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.6.3...v19.6.5

[19.6.3] - 2026-02-27

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.6.2...v19.6.3

[19.6.2] - 2026-02-26

What's Changed

fix: fix overwrites pnpm-workspace.yaml and .yarnrc.yml into json by @MKruschke in #1589

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.6.1...v19.6.2

[19.6.1] - 2026-02-26

What's Changed

Swap diff service. by @diegocr in #1603

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.6.0...v19.6.1

[19.6.0] - 2026-02-26

What's Changed

Display link to compare the changes between package versions (--format diff) by @diegocr in #1602

New Contributors

@diegocr made their first contribution in #1602

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.5.0...v19.6.0

[19.5.0] - 2026-02-24

What's Changed

feat(homepage): Add --format homepage option to print homepage.

e.g.

$ ncu --format homepage
...
 mocha                      ^11.7.2  →   ^11.7.5    https://mochajs.org/
 npm-registry-fetch         ^19.0.0  →   ^19.1.1
 prettier                   ^3.6.2  →    ^3.8.1     https://prettier.io
...

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.4.1...v19.5.0

[19.4.1] - 2026-02-19

What's Changed

Fixed a small cooldown regression with number types in the ncurc

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.4.0...v19.4.1

[19.4.0] - 2026-02-18

What's Changed

feat(cooldown): support cooldown strings like "7d", "12h", "30m" by @aversini in #1598

New Contributors

@aversini made their first contribution in #1598

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.3.2...v19.4.0

[19.3.2] - 2026-01-26

What's Changed

docs: close code tag instead of reopening another one by @sod in #1588
fix(tests): resolve EBUSY errors on Windows by retrying directory removal by @Zamiell in #1590

New Contributors

@sod made their first contribution in #1588

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.3.1...v19.3.2

[19.3.1] - 2026-01-05

What's Changed

fix(catalog): use the right yarn config name by @MKruschke in #1586

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.3.0...v19.3.1

[19.3.0] - 2026-01-04

What's Changed

feat: support yarn catalogs by @MKruschke in #1582
Fixed default catalog behavior.
- See discussion here: #1582 (review)
- If you think this is wrong, please open an issue.

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.2.1...v19.3.0

[19.2.1] - 2026-01-02

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.2.0...v19.2.1

[19.2.0] - 2025-12-10

What's Changed

Add --format dep
Add interactive mode keyboard controls to docs by @jsoref in #1577
Spelling by @jsoref in #1578

New Contributors

@jsoref made their first contribution in #1577

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.1.2...v19.2.0

[19.1.2] - 2025-10-28

What's Changed

fix: support singular 'catalog' field in pnpm-workspace.yaml by @afonsojramos in #1572

New Contributors

@afonsojramos made their first contribution in #1572

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.1.1...v19.1.2

[19.1.1] - 2025-10-15

What's Changed

fix(cooldown): handle CooldownFunction in config file by @SebastianSedzik in #1565

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.1.0...v19.1.1

[19.1.0] - 2025-10-13

What's Changed

feat(cooldown): support for cooldown predicate function by @SebastianSedzik in #1563

Full Changelog: https://github.com/raineorshine/npm-check-updates/compare/v19.0.0...v19.1.0

[19.0.0] - 2025-09-29

Breaking

node >= 20 required
--workspaces (plural) short option -ws changed to -w
- Better compatibility with commander v13
- Short option should always be a single character for consistency
- Replaces the short option for --workspace (singular)
- --workspace (singular) no longer has a short option.

[18.2.0] - 2025-09-18

Thanks to community members for raising awareness and to @SebastianSedzik for the implementation.

See: #1547

Feature: `--cooldown`

Usage:

ncu --cooldown [n]
ncu -c [n]

The cooldown option helps protect against supply chain attacks by requiring package versions to be published at least the given number of days before considering them for upgrade.

Note that previous stable versions will not be suggested. The package will be completely ignored if its latest published version is within the cooldown period. This is due to a limitation of the npm registry, which does not provide a way to query previous stable versions.

Example:

Let's examine how cooldown works with a package that has these versions available:

1.0.0          Released 7 days ago    (initial version)
1.1.0          Released 6 days ago    (minor update)
1.1.1          Released 5 days ago    (patch update)
1.2.0          Released 5 days ago    (minor update)
2.0.0-beta.1   Released 5 days ago    (beta release)
1.2.1          Released 4 days ago    (patch update)
1.3.0          Released 4 days ago    (minor update) [latest]
2.0.0-beta.2   Released 3 days ago    (beta release)
2.0.0-beta.3   Released 2 days ago    (beta release) [beta]

With default target (latest):

ncu --cooldown 5

No update will be suggested because:

Latest version (1.3.0) is only 4 days old.
Cooldown requires versions to be at least 5 days old
Use --cooldown 4 or lower to allow this update

With @beta/@tag target:

ncu --cooldown 3 --target @beta

No update will be suggested because:

Current beta (2.0.0-beta.3) is only 2 days old
Cooldown requires versions to be at least 3 days old
Use --cooldown 2 or lower to allow this update

With other targets:

ncu --cooldown 5 --target greatest|newest|minor|patch|semver

Each target will select the best version that is at least 5 days old:

greatest → 1.2.0        (highest version number outside cooldown)
newest   → 2.0.0-beta.1 (most recently published version outside cooldown)
minor    → 1.2.0        (highest minor version outside cooldown)
patch    → 1.1.1        (highest patch version outside cooldown)

Note for latest/tag targets:

⚠️ For packages that update frequently (e.g. daily releases), using a long cooldown period (7+ days) with the default --target latest or --target @tag may prevent all updates since new versions will be published before older ones meet the cooldown requirement. Please consider this when setting your cooldown period.

[18.0.0] - 2025-04-21

Breaking

The only breaking change in v18 is with the -g/--global flag.

npm-check-updates -g will now auto-detect your package manager based on the execution path. Previously, it defaulted to npm.

yarn dlx ncu -g --packageManager yarn → yarn dlx ncu -g
pnpm dlx ncu --global --packageManager pnpm → pnpm dlx ncu -g
bunx ncu -g--packageManager pnpm → bunx ncu -g

If for some reason you were running ncu -g with an alternative package manager and relying on it checking the global npm packages, you will need to now explicitly specify npm:

ncu -g → ncu -g--packageManager npm

Thanks to @LuisFerLCC for the improvement (#1514).

[17.0.0] - 2024-07-31

Breaking

Require node >= 18.18.0
Deprecated versions are no longer excluded by default, as it requires fetching package info for every published version, significantly slowing down upgrades.
- You can opt in with --no-deprecated in the CLI or deprecated: false in your ncurc config.
In workspaces mode, --root is now set by default (#1353)
- To not check the root package.json, use --no-root.
If you have a packageManager field in your package.json, it is now upgraded by default (#1390)
- Use --dep prod,dev,optional for the old behavior.

[17.0.0-1] - 2024-03-14

This is the first prerelease in preparation for the next major v17. It mainly involves a node engines bump and lot of internal dependency upgrades, so if you notice any regressions, please let me know!

Run npx npm-check-updates@v17.0.0-1 to test.

There are a two more breaking/high-risk changes I intend to make for the v17 release, which I will also release as prerelease versions for testing.

Thanks for your help and enjoy! 🍰

Breaking

Require node >= 18.18.0
In workspaces mode, --root is now set by default (#1353)
- To not check the root package.json, use --no-root.
Convert from CommonJS to ESM (#1358)
Replace pacote with npm-registry-fetch (#1329)

[16.14.0] - 2023-09-13

Feature

Added experimental support for bun package manager.
Automatically used if bun.lockb is detected.
Assistance needed to test it out on different platforms.

ncu --packageManager bun
ncu -p bun

Thanks to @ImBIOS for the PR!

[16.13.0] - 2023-08-22

Feature

Added --install option to control auto-install behavior.

Usage:

ncu --install [value]

Default: prompt

Control the auto-install behavior.

always	Runs your package manager's install command automatically after upgrading.
never	Does not install and does not prompt.
prompt	Shows a message after upgrading that recommends an install, but does not install. In interactive mode, prompts for install. (default)

[16.10.0] - 2023-04-02

Feature

Added filterResults option to filter out upgrades based on a user provided function.

filterResults runs after new versions are fetched, in contrast to filter and filterVersion, which run before. This allows you to filter out upgrades with filterResults based on how the version has changed (e.g. a major version change).

Only available in .ncurc.js or when importing npm-check-updates as a module.

/** Filter out non-major version updates.
  @param {string} packageName               The name of the dependency.
  @param {string} currentVersion            Current version declaration (may be range).
  @param {SemVer[]} currentVersionSemver    Current version declaration in semantic versioning format (may be range).
  @param {string} upgradedVersion           Upgraded version.
  @param {SemVer} upgradedVersionSemver     Upgraded version in semantic versioning format.
  @returns {boolean}                        Return true if the upgrade should be kept, otherwise it will be ignored.
*/
filterResults: (packageName, { currentVersion, currentVersionSemver, upgradedVersion, upgradedVersionSemver }) => {
  const currentMajorVersion = currentVersionSemver?.[0]?.major
  const upgradedMajorVersion = upgradedVersionSemver?.major
  if (currentMajorVersion && upgradedMajorVersion) {
    return currentMajorVersion < upgradedMajorVersion
  }
  return true
}

For the SemVer type definition, see: https://git.coolaj86.com/coolaj86/semver-utils.js#semverutils-parse-semverstring

Thanks to mslowiak for this enhancement!

[16.8.0] - 2023-03-22

Feature

Added --format lines

$ ncu --format lines
@ava/typescript@^4.0.0
ava@^5.2.0
eslint@^8.36.0
lerna@^6.5.1
typescript@^5.0.2

This is particularly useful for upgrading global modules:

npm install -g $(ncu -g --format lines)

Thanks to @vanodevium for the PR!

[16.4.0] - 2022-11-14

Feature

Added --cacheClear option for—you guessed it—clearing the cache 🫥.

This brings the suite of cache-related options to:

--cache : Cache versions to the cache file.
--cacheClear : Clear the default cache, or the cache file specified by --cacheFile.
--cacheExpiration <min> : Cache expiration in minutes (default: 10).
--cacheFile <path> : Filepath for the cache file (default: "~/.ncu-cache.json").

Thanks to @ly3xqhl8g9 whose code is gratefully more lucid than his username.

[16.3.0] - 2022-09-23

Feature

Added workspace support! 🚢

Upgrade all workspaces:

ncu --workspaces
ncu -ws

Upgrade a single workspace:

ncu --workspace a
ncu -w a

Upgrade more than one workspace:

ncu --workspace a --workspace b
ncu -w a -w b

Upgrade all workspaces AND the root project:

ncu --workspaces --root

Upgrade a single workspace AND the root project:

ncu --workspace a --root

Notes

If workspaces or --workspace is run in --interactive mode, ncu will prompt to npm install once in the root project rather than separately in each workspace (#1182).
Running --deep will not trigger workspace support.

[16.0.0] - 2022-07-23

Breaking

Automatic detection of package data on stdin has been removed. This feature was deprecated in v14.0.0. Add --stdin for old behavior. (#136)
Wild card filters now apply to scoped packages. Previously, ncu -f '*vite*' would not include @vitejs/plugin-react. Now, filters will match any part of the package name, including the scope. Use a more specific glob or regex expression for old behavior. (#1168)

[15.0.0] - 2022-06-30

Breaking

node >= 14.14 is now required (#1145)
- Needed to upgrade update-notifier with has a moderate severity vulnerability
yarn autodetect has been improved (#1148)
- This is a patch, though technically it is breaking. In the obscure case where --packageManager is not given, there is no package-lock.json in the current folder, and there is a yarn.lock in an ancestor directory, npm-check-updates will now use yarn.
- More practically, if you needed to specify --packageManager yarn explicitly before, you may not have to now

[14.1.0] - 2022-06-23

Features

Group

You can now group upgrades by risk level using --format group:

Interactive Mode

Interactive mode was completely rewritten for a better user experience.

Inspired by npm-check.

Combine with --format group for a truly luxe experience:

Static Registry

A new option --packageManager staticRegistry allows upgrades to be recommended from a static JSON file. This can be used to power custom versioning infrastructure that is completely independent from the npm registry.

Thanks to agrouse who did a fine job on the PR.

Example:

ncu --packageManager staticRegistry --registry ./my-registry.json

my-registry.json:

{
  "prettier": "2.7.0",
  "typescript": "4.7.0"
}

The latest versions of prettier and typescript are set in the registry file. When ncu is run, it will recommend upgrades from the static registry file without touching the npm registry:

$ ncu --packageManager staticRegistry --registry ./my-registry.json
Checking /Users/raine/projects/ncu-issues/14.1.0/package.json
[====================] 2/2 100%

 prettier    ^2.0.1  →  ^2.7.0
 typescript  ^3.4.0  →  ^4.7.0

Run ncu -u to upgrade package.json

[14.0.0] - 2022-06-16

Breaking

Prerelease versions are now "upgraded" to versions with a different preid.

For example, if you have a dependency at 1.3.3-next.1 and the version fetched by ncu is 1.2.3-dev.2, ncu will suggest an "upgrade" to 1.2.3-dev.2. This is because prerelease versions with different preids are incomparable. Since they are incomparable, ncu now assumes the fetched version is desired.

Since this change affects only prereleases, there is no impact on default ncu usage that fetches the latest version. With --pre or --target newest or --target greatest, this change could affect which version is suggested if versions with different preids are published. The change was made to support the new --target @[tag] feature.

If you have a use case where this change is not what is desired, please report an issue. The intention is for zero disruption to current usage.

Features

You can now upgrade to a specific tag, e.g. --target @next. Thanks to IMalyugin.

Deprecated

Default stdin handling is deprecated. Please explicitly add the --stdin option when reading package data from stdin.

[13.0.0] - 2022-05-15

Breaking

node >= 14 is now required
Several options which have long been deprecated have been removed:
- --greatest - Instead use --target greatest
- --newest - Instead use --target newest
- --ownerChanged - Instead use --format ownerChanged
- --semverLevel - Renamed to --target

[12.2.0] - 2022-01-21

Added --retry <n> option to automatically retried failed requests for package information. Defaults to 3 retries.

Hopefully this relieves the frustrating situation of having npm-check-updates fail at the end of a long upgrade! You can control the number of retries with --retry <n>, including setting it to 0 for no retries (the previous behavior).

[12.0.0] - 2021-11-04

Breaking

node >= 12 is required. Time to upgrade that old-ass server you never touch.
peerDependencies are now excluded by default. Peer dependencies should use the lowest possible version that works. The old behavior encouraged a bad practice of uprading peer dependencies. You can use --dep prod,dev,bundle,optional,peer for the old behavior (#951).
Dependencies with > will be converted to >=. The old behavior was causing upgrades to > [latest] which was impossible (#957).

Other

Typescript! There is a new build process, so if you have any issues with the executable or types, please report. It should be a non-breaking change if I did it correctly (#888).
When using npm-check-updates as a module, vm (versionmanager) is no longer exported. It was previously exposed for testing purposes, but was never part of the official API.

[12.0.0-0] - 2021-05-29

Coming soon...

Typescript
Remove unofficial exports
Bump node >= 12

Early testers are greatly appreciated! In particular, let me know if you use any of the unofficial exports and can provide a case for their retention. Removing them will free up the internal API to do some architectural refactoring down the road.

Full details will be provided in the v12.0.0 release.

[11.5.0] - 2021-04-20

Minor

npm-check-updates will now auto-detect yarn and apply --packageManager yarn when yarn.lock is present and package-lock.json is not present. You can override this by explicitly setting --packageManager npm. It will print "Using yarn" when the auto-detection is triggered.

[11.4.0] - 2021-04-07

Minor

Use --peer to check peer dependencies of installed packages and filter updates to compatible versions.
- 791aa22 Respect peer dependencies (#869)
Bump mem (minor)

Patch

696168b --deep: Fix Windows path
Bump dependencies (patch)

[11.2.0] - 2021-03-07

Wildcards and globs can now be used in filters without having to use regex:

ncu react-*      # upgrade packages that start with "react-"
ncu \!commander  # upgrade everything except "commander"

Since special characters are not allowed in package names, this change shouldn't break anything, but please let me know if a filter that was working before v11.2.0 is not now!

Commits

ee27448 Add filter support for wildcards and glob expressions. Fixes #219.

[11.0.0] - 2021-01-21

Breaking

--packageFile - Now interprets its argument as a glob pattern. It is possible that a previously supplied argument may be interepreted differently now (though I'm not aware of specific instances). Due to our conservative release policy we are releasing as a major version upgrade and allowing developers to assess for themselves.

Features

--deep - Run recursively in current working directory. Alias of --packageFile '**/package.json'.

See: #785

https://github.com/raineorshine/npm-check-updates/compare/v10.3.1...v11.0.0

[10.0.0] - 2020-11-08

Breaking

Specifiying both the --filter option and argument filters will now throw an error. Use one or the other. Previously the arguments would override the --filter option, which made for a confusing result when accidentally not quoting the option in the shell. This change is only breaking for those who are relying on the incorrect behavior of argument filters overriding --filter.

See: #759

https://github.com/raineorshine/npm-check-updates/compare/v9.2.4...v10.0.0

[9.0.0] - 2020-09-10

Breaking

Versions marked as deprecated in npm are now ignored by default. If the latest version is deprecated, the highest non-deprecated version will be suggested. Use --deprecated to include deprecated versions (old behavior).

https://github.com/raineorshine/npm-check-updates/compare/v8.1.1...v9.0.0

[8.0.0] - 2020-08-29

Breaking

--semverLevel major is now --target minor. --semverLevel minor is now --target patch. This change was made to provide more intuitive semantics for --semverLevel (now --target). Most people assumed it meant the inclusive upper bound, so now it reflects that. a2111f4c2
Programmatic usage: run now defaults to silent: true instead of loglevel: 'silent, unless loglevel is explicitly specified. If you overrode silent or loglevel, this may affect the logging behavior. 423e024

Deprecated

Options that controlled the target version (upper bound) of upgrades have been consolidated under --target. The old options are aliased with a deprecation warning and will be removed in the next major version. No functionality has been removed.

--greatest: Renamed to --target greatest
--newest: Renamed to --target newest
--semverLevel: Renamed to --target

See: 7eca5bf3

Features

Doctor Mode

#722

Usage: ncu --doctor [-u] [options]

Iteratively installs upgrades and runs tests to identify breaking upgrades. Add -u to execute (modifies your package file, lock file, and node_modules).

To be more precise:

Runs npm install and npm test to ensure tests are currently passing.
Runs ncu -u to optimistically upgrade all dependencies.
If tests pass, hurray!
If tests fail, restores package file and lock file.
For each dependency, install upgrade and run tests.
When the breaking upgrade is found, saves partially upgraded package.json (not including the breaking upgrade) and exits.

Example:

$ ncu --doctor -u
npm install
npm run test
ncu -u
npm install
npm run test
Failing tests found:
/projects/myproject/test.js:13
  throw new Error('Test failed!')
  ^
Now let's identify the culprit, shall we?
Restoring package.json
Restoring package-lock.json
npm install
npm install --no-save react@16.0.0
npm run test
  ✓ react 15.0.0 → 16.0.0
npm install --no-save react-redux@7.0.0
npm run test
  ✗ react-redux 6.0.0 → 7.0.0
Saving partially upgraded package.json

Github URLs

Added support for GitHub URLs.

See: f0aa792a4

Example:

{
  "dependencies": {
    "chalk": "https://github.com/chalk/chalk#v2.0.0"
  }
}

npm aliases

Added support for npm aliases.

See: 0f6f35c

Example:

{
  "dependencies": {
    "request": "npm:postman-request@2.88.1-postman.16"
  }
}

Owner Changed

#621

Usage: ncu --ownerChanged

Check if the npm user that published the package has changed between current and upgraded version.

Output values:

Owner changed: *owner changed*
Owner has not changed: no output
Owner information not available: *unknown*

Example:

$ ncu --ownerChanged
Checking /tmp/package.json
[====================] 1/1 100%

 mocha  ^7.1.0  →  ^8.1.3  *owner changed*

Run ncu -u to upgrade package.json

Commits

https://github.com/raineorshine/npm-check-updates/compare/v7.1.1...v8.0.0

[7.0.0] - 2020-06-09

Breaking

Removed bower support (4e4b47fd3bb567435b456906d0106ef442bf46fe)

Patch

Fix use of "<" with single digit versions (f04d00e550ce606893bee77b78ef2a0b2a50246a)

Other

Change eslint configuration
Update dependencies
Replace cint methods with native methods
Add CI via GitHub Actions workflow

[6.0.0] - 2020-05-15

Breaking

--semverLevel now supports version ranges. This is a breaking change since version ranges are no longer ignored by --semverLevel, which may result in some dependencies having new suggested updates.

If you are not using --semverLevel, NO CHANGE! 😅

[5.0.0] - 2020-05-11

Breaking*

~~node >= 8~~ node >= 10.17

Bump minimum node version to v10.17.0 due to move-file #651

*If ncu was working for you on v4.x, then v5.0.0 will still work. Just doing a major version bump since ncu's officially supported node version is changing. v4 should be patched to be compatible with node v8, but I'll hold off unless someone requests it.

[4.1.0] - 2020-03-26

Feature

Added --concurrency to set the maximum number of concurrent HTTP requests to the npm registry (default: 8).

Fix

Pass --timeout correctly to pacote so that process is properly terminated when timeout is exceeded.

[4.0.0] - 2019-12-10

ncu v3 excluded prerelease versions (-alpha, -beta, etc) from the remote by default, as publishing prerelease versions to latest is unconventional and not recommended. Prereleases versions can be included by specifying --pre (and is implied in options --greatest and --newest).

However, when you are already specifying a prerelease version in your package.json dependencies, then clearly you want ncu to find newer prerelease versions. This is now default in v4, albeit with the conservative approach of sticking to the latest tag.

Migration

No effect for most users.

If a prerelease version is published on the latest tag, and you specify a prerelease version in your package.json, ncu will now suggest upgrades for it.

If a prerelease version is published on a different tag, there is no change from ncu v3; you will still need --pre, --greatest, or --newest to get prerelease upgrades.

[3.2.0] - 2019-11-03

Added --engines-node option to include only packages that satisfy engines.node as specified in the package file.

See unit tests for detailed behavior.

[3.0.0] - 2019-03-07

Breaking changes

node < 8 deprecated

The required node version has been updated to allow the use of newer Javascript features and reduce maintenance efforts for old versions.

System npm used

In ncu v2, an internally packaged npm was used for version lookups. When this became out-of-date and differed considerably from the system npm problems would occur. In ncu v3, the system-installed npm will be used for all lookups. This comes with the maintenance cost of needing to upgrade ncu whenever the output format of npm changes.

Installed modules ignored

In ncu v2, out-of-date dependencies in package.json that were installed up-to-date (e.g. ^1.0.0 specified and 1.0.1 installed) were ignored by ncu. Installed modules are now completely ignored and ncu only consider your package.json. This change was made to better match users’ expectations.

Existing version ranges that satisfy latest are ignored (-a by default)

In ncu v2, if you had ^1.0.0 in your package.json, a newly released 1.0.1 would be ignored by ncu. The logic was that ^1.0.0 is a range that includes 1.0.1, so you don’t really need to change the version specified in your package.json, you just need to run npm update. While logical, that turned out to be quite confusing to users. In ncu v3, the package.json will always be upgraded if there is a newer version (same as -a in v2). The old default behavior is available via the --minimal option.

Prerelease versions ignored

In ncu v2, any version published to the latest tag was assumed to be a stable release version. In practice, occasional package authors would accidentally or unconventionally publish -alpha, -beta, and -rc versions to the latest tag. While I still consider this a bad practice, ncu v3 now ignores these prerelease versions by default to better match users’ expectations. The old behavior is available via the --pre 1 option. (When --newest or --greatest are set, --pre 1 is set by default, and can be disabled with --pre 0).

Options changed: `-m`, `--prod`, `--dev`, `--peer`

In order to only target one or more dependency sections, ncu now uses the --dep option instead of separate options for each section.

--prod is now --dep prod --dev is now --dep dev --dev --peer is now --dep dev,peer etc

The --packageManager alias has changed from -m to -p to make room for --minimal as -m.

[2.12.0] - 2017-06-20

Added --peer option to check peerDependencies.

Fixes #80 (comment)

[2.11.2] - 2017-05-24

Maintain 0.12.x compatibility; do not use Object.assign.

PR #353

[2.11.1] - 2017-05-10

Changed hard-to-read blue to cyan.

Fixes #346.

[2.11.0] - 2017-04-17

Added --timeout <ms> option.

PR #339, fixes #290

[2.10.5] - 2017-04-03

PATCH: Allow multiple instances of ncu to be run programmatically.

PR #336, fixes #328.

[2.10.4] - 2017-03-22

Fixes #329 with PR #332.

[2.3.2] - 2015-10-13

Fix wording in update message to be package manager agnostics (#145).

[2.3.1] - 2015-10-13

Do not crash when installed package is undefined (#148).

[2.3.0] - 2015-10-03

Added bower support (#43).

[2.2.1] - 2015-09-09

Fixed #128

[2.1.0] - 2015-08-14

Add -o/--optional to check only optionalDependencies

[2.0.0] - 2015-08-14

v2 has a few important differences from v1:

Newer published versions that satisfy the specified range are not upgraded by default (e.g. 1.0.0 to 1.1.0). This change was made because npm update handles upgrades within the satisfied range just fine, and npm-check-updates is primarily intended to provide functionality not otherwise provided by npm itself. These satisfied dependencies will still be shown when you run npm-check-updates, albeit with a short explanation. For the old behavior, add the -ua/--upgradeAll option.
The command-line argument now specifies a package name filter (e.g. ncu /^gulp-/). For the old behavior (specifying an alternative package.json), pipe the package.json through stdin.
Use the easier-to-type ncu instead of npm-check-updates. npm-check-updates is preserved for backwards-compatibility.

Changelog

Allow packageData to be specified as an option
Colored table output
Add -a/--upgradeAll
Add -e/--error-level option
Add -j/--json and --jsonFlat flags for json output
Add -r/--registry option for specifying third-party npm registry
Add -t/--greatest option to search for the highest versions instead of the default latest stable versions.
Remove -f/--filter option and move to command-line argument
Replace < and <= with ^
Automatically look for the closest descendant package.json if not found in current directory
Add ncu alias
Export functionality to allow for programmatic use
Bug fixes and refactoring
Full unit test coverage!

[1.5.1] - 2015-08-14

Fix bug where package names got truncated (grunt-concurrent -> grunt)

[1.5.0] - 2015-08-14

Add prod and dev only options

[1.4.0] - 2015-08-14

Add package filtering option
Add mocha as npm test script

[1.3.0] - 2015-08-14

Handle private packages and NPM errors
Added Mocha tests
Bugfixes

[1.2.0] - 2015-08-14

Print currently installed and latest package version in addition to semantic versions
Fixed bug where extra whitespace in package.json may prevent automatic upgrade

[1.1.0] - 2015-08-14

Added option to check global packages for updates: -g switch
Now also checks and upgrades devDependencies in package.json

[1.0.0] - 2015-08-14

Find and upgrade dependencies maintaining existing versioning policy in package.json

[2.2.0] - 2015-08-14

Add --packageFile option to specify alternative package.json

FilesExpand file tree

CHANGELOG.md

Latest commit

History

CHANGELOG.md

File metadata and controls

Changelog

[23.1.0] - 2026-08-23

Added new option: --interactiveSelect

Other Changes

New Contributors

[23.0.2] - 2026-08-07

What's Changed

[23.0.1] - 2026-08-02

What's Changed

[23.0.0] - 2026-07-26

⚠️ Breaking changes & migration

✨ Other improvements

[22.2.9] - 2026-06-28

What's Changed

[22.2.8] - 2026-06-27

What's Changed

[22.2.7] - 2026-06-20

What's Changed

[22.2.6] - 2026-06-20

What's Changed

New Contributors

[22.2.5] - 2026-06-06

[22.2.4] - 2026-06-06

[22.2.3] - 2026-06-06

What's Changed

[22.2.2] - 2026-06-03

What's Changed

[22.2.1] - 2026-05-24

What's Changed

[22.2.0] - 2026-05-12

What's Changed

[22.1.1] - 2026-05-07

What's Changed

New Contributors

[22.1.0] - 2026-05-02

What's Changed

[22.0.1] - 2026-04-25

What's Changed

[22.0.0] - 2026-04-25

Breaking Changes

⚠️ WARNING

How to opt out of the new behavior

What's Changed

New Contributors

[21.0.3] - 2026-04-21

What's Changed

[21.0.2] - 2026-04-16

What's Changed

[21.0.1] - 2026-04-15

What's Changed

[21.0.0] - 2026-04-14

⚠️ Breaking Changes

ESM Migration & Module System

Configuration Files (.ncurc.js)

Dependency Updates (Pure ESM versions)

Tooling & Build Changes

Migration Guide

1. Environment Check

2. Update Configuration Files

3. Update Programmatic Usage

Testing

Related Issues & PRs

[20.0.2] - 2026-04-13

What's Changed

New Contributors

[20.0.1] - 2026-04-10

What's Changed

[20.0.0] - 2026-03-31

Auto Cooldown

Other changes

New Contributors

[19.6.6] - 2026-03-26

[19.6.5] - 2026-03-16

What's Changed

Added new option: `--interactiveSelect`

Configuration Files (`.ncurc.js`)

Feature: `--cooldown`